CVE-2026-105210

ZITADEL 3.x before 3.4.15 and 4.x before 4.17.1 contains a missing authentication flaw in the hosted Login V1 UI, whose second-factor enrollment and initialization handlers act on an identify-only session before any primary factor is verified. Attackers knowing only a victim's login name can enro...

CVE-2026-105215

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

CVE-2025-63587

rittalvuln 이 취약점은 확실히 3.15.704 펌웨어를 사용하는 Rittal CMC III 7030.000에 해당되지만, 다른 제품에도 적용될 가능성이 있습니다. 취약점의 핵심: 올바른 로그인을 하면 응답으로 "login failed"가 반환되지만, 잘못된 로그인을 하면 "some error has occured..." 오류가 반환됩니다. 올바른 로그인 잘못된 로그인...

CVE-2024-49379

CVE-2024-49379에 대한 개념 증명PoC 이 저장소에는 UmbrelOS에서 확인된 치명적인 취약점에 대한 Python 기반 개념 증명PoC이 포함되어 있습니다. 이 취약점은 XSS교차 사이트 스크립팅를 허용하며, 특정 조건에서 RCE원격 코드 실행로 확대될 수 있습니다. 개요 CVE : CVE-2024-49379 심각도 : 치명적Critical 취약점 유형 : RCE원격 코드 실행로 이어지는 XSS교차 사이트 스크립팅 영향을 받는 소프트웨어 : 1.2.2 이전 버전의 UmbrelOS 발견자 : Peter Stöckli...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - 인증 누락으로 인한 임의 옵션 업데이트 취약점 설명: WordPress용 Login/Signup Popup Inline Form + Woocommerce 플러그인은 2.7.12.7.2 버전에서 'importsettings' 함수에 대한 권한 확인이 누락되어 데이터의 무단 수정에 취약합니다. 이로 인해 구독자 수준 이상의 인증된 공격자가 영향을 받는 사이트에서 임의의 옵션을 변경할 수 있습니다. ...

zyxel-social-login-bypass-cve-2026-8508

CVE-2026-8508: Zyxel Captive-Portal Bypass via Trusted Browser-Submitted Facebook Identity このリポジトリは、CVE-2026-8508 に関する公開ライトアップ、クイック検証スクリプト、および関連する補助成果物をまとめたものです。 これは何か CVE-2026-8508 は、Zyxel キャプティブポータルのソーシャルログインにおける事前認証の信頼境界欠陥です。ここでのローカルリバース解析は WAX650S V7.10ABRM.4C0 を対象としています。ブラウザが Facebook 側の ID...

CVE-2025-68722

CVE-2025-68722: Axigen WebAdmin CSRF 취약점 요약 Axigen WebAdmin 인터페이스의 중요한 상태 변경 작업은 GET 요청 을 통해 접근할 수 있습니다. h 토큰은 직접적인 CSRF를 방지하지만, 애플리케이션은 사용자가 인증한 직후 sbreadcrumb 매개변수를 통해 대기 중인 요청을 처리합니다. 공격자는 s 매개변수에 Base64로 인코딩된 페이로드가 포함된 URL을 제작할 수 있습니다. 관리자가 이 링크를 클릭하고 로그인 과정을 완료하면, 대기 중인 작업이 관리자의 컨텍스트에서 자동으로...

EUVD-2026-92108

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

CVE-2026-105215

ZITADEL versions before 3.4.14 and 4.x before 4.16.2 are vulnerable to an authentication bypass within the hosted Login V1 UI . The root cause is that the 'external account not found' registration endpoint trusts client-supplied external identity fields without requiring a completed IdP callback ...

CVE-2026-105215 ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

CVE-2026-105215 ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

CVE-2026-105215 ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback

ZITADEL before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 UI because the 'external account not found' registration endpoint trusts client-supplied external identity fields without a completed IdP callback. Unauthenticated attackers can submit forged...

EUVD-2026-92106

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

EUVD-2026-92105

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105213 ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

CVE-2026-105213 ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

CVE-2026-105213 ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations

ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user's status. Users of a deactivated organization who hold valid credentials, an existing session, or a refresh token can still sign in, create sessions, and...

CVE-2026-105212

ZITADEL versions prior to 3.4.14 and 4.16.2 are vulnerable to an authentication bypass in the hosted Login V1 and Login V2 UIs. The root cause is the system's acceptance of passkey or other authenticator enrollments during identify-only login sessions before a primary factor is verified. This all...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...

CVE-2026-105212 ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment

ZITADEL 3.x before 3.4.14 and 4.x before 4.16.2 contains an authentication bypass in the hosted Login V1 and Login V2 UIs that accepts passkey or other authenticator enrollment on identify-only login sessions, before any primary factor is verified. Unauthenticated attackers knowing only a victim'...